A NordPass sign-in involves several independent parts: the page or app you opened, the master password you type, an optional second factor, the local state of the encrypted vault on that device, and the sync connection that reconciles your items with your other devices. The phrase "my NordPass login is not working" points at none of these specifically, and guessing wastes the one attempt budget you have when rate limiting is active.
Before changing anything, write down four facts: the exact message on screen, the local time it appeared, the device and app you were using, and whether the problem happens in the desktop app, the mobile app, the browser extension, or more than one of them. Never write down the master password itself, and never send a screenshot containing a partially filled password field to anyone.
Confirm that you opened the real entry point
Most alarming "login problems" are not password problems at all. A look-alike page, a mistyped hostname, or an expired certificate will reject a perfectly correct master password, and the error often looks identical to a wrong password in a small window.
Check the address bar before you check anything else. A genuine vendor domain uses a valid certificate, loads without a browser warning, and never asks for a master password immediately after a redirect from an email link. If you arrived through a link in a message, open the site from your own bookmark instead. If the browser shows a certificate warning, close the tab rather than clicking through it.
For a general description of where a legitimate nordpass login begins and what a genuine page never requests, see our nordpass login overview.
Rule out the keyboard before everything else
Master passwords are long, so a single mistyped capital or a wrong keyboard layout rejects them reliably. Check that caps lock is off, that the input language matches the layout you memorised the password in, and that the field simply accepts spaces. A password with a trailing space, added by an autocorrect or an accidental keypress, is one of the most common causes of a rejected master password on an account that worked yesterday.
Use the reveal option built into the field if one exists, or paste the password from a trusted password manager rather than typing it. Revealing the characters in front of someone else is a different decision from typing them, and on a shared screen a revealed password is a visible one.
Understand what "accepted but locked" actually means
There is a meaningful difference between a rejected password and an accepted one that leaves the vault locked. Acceptance means the entered master password produced the correct encryption key. What happens next belongs to a later stage, and those later stages have entirely different causes.
A pending second-factor prompt, a device that is offline and therefore cannot complete a sync check, a security hold triggered by repeated failed attempts on the account, or an expired session on a device you are trying to add can all produce a successful password entry followed by a refusal. Waiting fifteen minutes without further attempts resolves rate limiting more often than any setting change.
Because the master password is never stored in readable form anywhere, changing it is not a diagnostic step. If you can remember it and it is being rejected, the problem is not that you forgot it.
Separate a local vault problem from an account problem
A vault that will not unlock on one device but opens normally on your phone is a device problem, and the account is fine. A vault that fails everywhere at once points to the account, the network, or an account-side security measure.
Test whether the device has general connectivity by loading an unrelated site. If the network is filtered, captive, or restricted on guest Wi-Fi, a sync step may never complete even though the master password is correct. Note that a vault can often be opened in a local-only mode for reading, which lets you confirm that the stored data itself is intact rather than assuming it is missing.
Do not delete local app data as a first response. On some platforms that removes cached credentials that you will then have to re-enter item by item, and it discards the state a support conversation would need.
Watch for sync conflicts between your devices
Syncing is what makes multiple devices useful and also introduces a class of problem that looks like a login failure. If two devices are offline at the same time and both receive changes, the next connection has to reconcile them. Depending on the client version and the item involved, this can produce a conflict warning, an item that reverts to an older version, or a sync that pauses and asks you to intervene.
When that happens, do not rapidly alternate between devices trying to force a refresh. Pick one device, bring it online, let it settle, and then check the result on the second device. If two devices genuinely received different edits to the same item, decide which version is correct before saving anything, because the loser of that decision may not be recoverable.
Check the second-factor path deliberately
Multi-factor authentication is a separate step with separate failure modes. If a prompt appears, approve it only when it follows a sign-in you just started and mentions the account you expect. If no prompt arrives, the registered method may be an authenticator app whose codes have drifted, an SMS number that no longer receives messages, or a hardware key that is no longer paired.
Never let another person read out a code to you, and never approve an unsolicited request. An unexpected approval prompt is either a stale request or an attempt to log in as you, and approving it is worse than ignoring it.
Build a support report that is safe to send
A useful report contains the product and app version, the platform and its version, the exact error wording, the timestamp with a time zone, which of your devices are affected, whether the vault opens in a local-only mode, and the last action you completed successfully. That last detail is often the most informative line in the whole message.
Remove everything sensitive before sending. Delete or redact usernames, email addresses, site names you consider sensitive, partial passwords, recovery codes, and any on-screen notification that might contain an account identifier. A screenshot cropped tightly around the error text communicates more than a full window capture.
Remember what this website can and cannot do. We are an independent fan site, so we cannot unlock your vault, reset your master password, or inspect your account. Only the vendor's official support channel can act on your account, and the report you prepare here is designed to make that conversation short.
A short order of operations
When you are stuck, this order resolves the majority of cases. Confirm the domain and certificate. Confirm the keyboard and layout. Try once more and wait if a limit is likely. Check connectivity. Check whether the vault opens locally without syncing. Check the second factor. Then write the report. Skipping to the last step without the earlier checks is what turns a five-minute fix into an afternoon.